Arifu Onishi, The University of Electro-Communications; S. Hrushikesh Bhupathiraju, Rishikesh Bhatt, and Sara Rampazzi, University of Florida; Takeshi Sugawara, The University of Electro-Communications
We introduce a novel electromagnetic (EM) side-channel attack that allows for acoustic eavesdropping on electronic devices.
This method specifically targets modern digital microelectromechanical systems (MEMS) microphones, which transmit captured audio via pulse-density modulation (PDM), that translate the analog sound signal into the density of output pulses in the digital domain.
We discover that each harmonic of these digital pulses retains acoustic information, allowing the original audio to be retrieved through simple FM demodulation using standard radio receivers.
- For example, we demonstrate that the attack achieves up to 94.2% accuracy in recognizing spoken digits, up to 2 meters from a victim laptop located behind a 25 cm concrete wall.
- We also evaluate the attacker capability to eavesdrop on speech using popular speech-to-text APIs (e.g., OpenAI) not trained on EM traces, achieving a maximum of 14% transcription error rate in recovering the Harvard Sentences dataset.
- We further demonstrate that similar accuracy can be achieved with a cheap and stealthy antenna made out of copper tape.
- We finally discuss the limited effectiveness of current defenses such as resampling, and we propose a new hardware defense based on clock randomization.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.
- PDM Microphones: Modern digital microphones, especially MEMS (Micro-Electro-Mechanical Systems) microphones commonly found in laptops, phones, and smart speakers, use PDM to convert analog sound into a digital signal.
- Electromagnetic Leakage: This conversion process generates electromagnetic radiation, which can be picked up by radio receivers.
- Acoustic Information Retention: Crucially, each harmonic of the PDM signal retains acoustic information from the original sound.
- FM Demodulation: Using simple FM demodulation with standard radio receivers, an attacker can extract and recover the audio information from these electromagnetic emissions.
- Conversations can be intercepted up to 2 meters away, even through walls.
- The attack is accessible with inexpensive equipment, such as a copper tape antenna and an FM radio receiver, costing under $100.
